Transformation Programme - Business Support SLAs City of York Council Internal Audit Report 2015/16

Directorate: Customer and Business Support Services Responsible Officer: Assistant Director, Customers and Employees Service Manager: Head of Admin and Business Support Date Issued: 18th March 2016 Status: Final Reference: 19230/030

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Reasonable Assurance | Summary and Overall Conclusions

Introduction In 2014-15, the council’s Business Support function underwent a significant restructure. Four new Business Support hubs are now responsible for providing administration services for 46 departments across all council directorates.

In order to ensure the Business Support hubs meet the needs of the departments, Service Level Agreements (SLAs) have been drawn up for agreement with the services they support.

Objectives and Scope of the Audit The purpose of this audit was to review the service level agreements and provide assurance on whether:

- Content is clear, adequate, and sufficiently detailed to allow tasks to be completed
- Arrangements have been made for monitoring performance and taking improvement action where required
- Agreements have been approved by appropriate officers

Key Findings Progress has been made towards implementing and agreeing SLAs within Business Support, however further action should be taken to ensure that this process is completed and fit for purpose moving forward.

Tasks have been documented for each service area and they are specific and detailed. However, not all service areas have reached agreement on the exact remit of Business Support and as a result SLAs are currently incomplete and have not been signed off.

Performance monitoring is currently included as generic text in the SLAs and does not appear to be tailored to individual services. Performance metrics should be agreed that are meaningful, measurable and are of value to the services as well as Business Support.

Overall Conclusions It was found that the arrangements for managing risk were satisfactory with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. Our overall opinion of the controls within the system at the time of the audit was that they provided Reasonable Assurance. 1 Agreement of tasks in SLAs

| Issue/Control Weakness | Risk | |------------------------|------| | SLAs have not been agreed or signed off. | Important tasks may be delayed or not completed; proposed efficiencies may not materialise. |

Findings

The process for drawing up the task requirements in the SLAs required services to draft tasks using the template table, which was then submitted to Business Support for discussion and agreement. Several iterations of task tables were then negotiated and agreed until services and Principal Business Support Officers (PBSOs) confirmed they were in agreement with the tasks required per the task table document.

Discussions with Heads of Service and PBSOs have identified that agreement on these tasks varies between SLAs. For some service areas it is relatively straightforward, however for others there have been disagreements on the content, although it is recognised that there will be a level of fluidity to these documents.

As a result, none of the SLAs that were sampled as part of this audit have been signed off by the Head of Service or the Head of Business Support as would be expected.

Agreed Action 1.1

All SLA’s will be re-visited, agreed and signed off.

| Priority | 2 | |----------|---| | Responsible Officer | Head of Admin and Business Support | | Timescale | 30th June 2016 | 2 Performance Monitoring

| Issue/Control Weakness | Risk | |---------------------------------------------------------------------------------------|----------------------------------------------------------------------| | The performance monitoring is not fully documented and the purpose of the front-end document is unclear. | Performance is not monitored and/or there is no mechanism for challenging and improving the service. |

Findings

SLAs are constituted of a front-end document which is standard for each area and a detailed task-list in an annex.

The majority of SLA front-end documents contain generic text in section 7 in relation to performance monitoring. A sample of SLAs was reviewed as part of this audit and these criteria do not appear to have been changed or tailored to fit the individual services and their requirements/key outputs, except for one example (Building Control/Development Management) where page 3 specifies 'twice yearly re-evaluation meeting to consider effectiveness of SLA and/or required amendments'.

Discussions with PBSOs found that the front-end document was rarely used or referred to and it was the annex that was of more importance. However, this does not include any detail or specific arrangements for performance monitoring (although one exception was noted).

It was also noted that the performance monitoring criteria (the generic/template ones set out in the front-end document) are not measures that are being recorded and reported to services; therefore this indicates that these criteria noted in the front end document are not representative of actual arrangements in place for monitoring performance.

Agreed Action 2.1

It has been agreed that there will be a single generic SLA for all services pertaining to general tasks (for example purchase orders, invoicing, train tickets). This will then allow tighter service specific SLAs in relation to business and service requirements which will include performance measures and also exceptions.

| Priority | 2 | |----------|---| | Responsible Officer | Head of Admin and Business Support | | Timescale | 30th June 2016 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |---------------------|-------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.